This PR makes the following changes:

• uses gcr.io/distroless/static-debian12 as the base image
• ensures the built containers are non-root users

In the process of working on this additional docker manifest updates were made:

• image_templates section was missing from the debug variant
• the top-level images should be the manifests and the tagged images should always be architecture specific (according to best practices)

This is the sister PR to anchore/syft#3941 contributed by @MikeTheCyberGuy

Changes

• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections